Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    decode_4a0c2ca9779415dba27de8c17cf3fd6b11407196fdf9e00de6edffd9e244d135

  • Size

    481KB

  • MD5

    c55d640aca24b85524e54653e47bb099

  • SHA1

    1c08e479e2c8e5fb670783328fdf2222b5998ba9

  • SHA256

    87494546833f3274a896371ba977e1d2f7980c0111a3ffd7daa94acbe8aa37bc

  • SHA512

    188e0cc63eeae2dbe516748d4505e955fd4daffed9d1af39bcfca0ac069c2ab7f2d7328befb2f65eb3b743c3f35eacd6a78a74793900d56d53b2b79ef15db7e9

  • SSDEEP

    12288:pRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2tDU:px7cyF2eSsewS8W47eZj

Score
10/10
new-08agoremcos

Malware Config

Extracted

Family

remcos

Botnet

New-08Ago

C2

tttmundo2022.eastus.cloudapp.azure.com:3232

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R7OLDN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • decode_4a0c2ca9779415dba27de8c17cf3fd6b11407196fdf9e00de6edffd9e244d135
    .exe windows x86

    04d77d421b8e5297898a3fce39d74267


    Headers

    Imports

    Sections